Preauth Full-Chain Root Command Execution via sync-demo App (LG webOS)
A full working exploit chain (exploit.py with reproduce steps) achieving unauthenticated root code execution on named LG webOS models was published within the last day, with LG reported to have already shipped a fix that owners must apply.
SSD Disclosure published a detailed write-up and working proof-of-concept chaining three bugs in LG webOS TVs: a signed-manifest replay that bypasses the PIN prompt to obtain a SECURE-tier client-key without authentication, an SSRF via cmp-client's interactiveUrl that reaches a private Luna service, and a command injection in pmlogd's collectAllLog via the targetDir parameter, yielding root shell execution. The researcher states this placed third in the LG webOS category at TyphoonPWN 2026 and that LG has issued a fix.
Affected: LG 32LQ636BPSA and LG 27TQ600SW running webOS 7.5.7-25 (Rockhopper, mullet-mirima), firmware 04.54.40; other models/firmware not stated
How to Test
Check whether you operate the named models (LG 32LQ636BPSA, 27TQ600SW) on webOS 7.5.7-25 / firmware 04.54.40, or any webOS TV with the sync-demo app installed; verify whether port 3001 (Luna/WSS) is reachable from guest networks or the internet, and apply the vendor's non-interactive proof-file check pattern from the report only in a controlled test environment, not production.
How to Patch
Apply the firmware update referenced in LG's security bulletin (https://lgsecurity.lge.com/bulletins/tv#updateDetails) for the affected TV models. Until updated, restrict LAN/network access to the TV's control plane (WSS port 3001) from untrusted devices, and remove or disable the sync-demo app (com.webos.app.sync-demo) if present.